Common Weakness Enumeration
CWE-703
DiscouragedImproper Check or Handling of Exceptional Conditions
Abstraction: Pillar · Status: Incomplete
The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
229 vulnerabilities reference this CWE, most recent first.
GHSA-QH5G-Q395-CX4J
Vulnerability from github – Published: 2026-07-24 14:15 – Updated: 2026-07-24 14:15
VLAI
Summary
ImageMagick: Heap-use-after-free via XMP profile could result in a crash
Details
Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.
Severity
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-AnyCPU"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-AnyCPU"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-OpenMP-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-x86"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-OpenMP-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-OpenMP-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-x86"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-AnyCPU"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-OpenMP-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-OpenMP-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-x64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q8-x86"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "NuGet",
"name": "Magick.NET-Q16-HDRI-arm64"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "14.15.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-252",
"CWE-400",
"CWE-416",
"CWE-476",
"CWE-703"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-24T14:15:23Z",
"nvd_published_at": null,
"severity": "LOW"
},
"details": "Because of a missing null check when parsing an XMP profile a use after free will happen that might result in a crash.",
"id": "GHSA-qh5g-q395-cx4j",
"modified": "2026-07-24T14:15:23Z",
"published": "2026-07-24T14:15:23Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qh5g-q395-cx4j"
},
{
"type": "PACKAGE",
"url": "https://github.com/ImageMagick/ImageMagick"
},
{
"type": "WEB",
"url": "https://github.com/dlemstra/Magick.NET/releases/tag/14.15.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "ImageMagick: Heap-use-after-free via XMP profile could result in a crash"
}
GHSA-QJH3-4J3H-VMWP
Vulnerability from github – Published: 2025-01-13 16:13 – Updated: 2025-01-14 21:07
VLAI
Summary
notation-go has an OS error when setting CRL cache leads to denial of signature verification
Details
Summary
The issue was identified during Quarkslab's security audit on the Certificate Revocation List (CRL) based revocation check feature. After retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination.
Details
In method crl.(*FileCache).Set, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated notation cache directory thanks os.Rename. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on rename syscall from the libc and as per the documentation, moving a file to a different mountpoint raises an EXDEV error, interpreted as Cross device link not permitted error.
Some Linux distribution, like RedHat use a dedicated filesystem (tmpfs), mounted on a specific mountpoint (usually /tmp) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash notation.
PoC
- Ensure that the temporary file storage area (e.g., /tmp) is mounted on a different mount point than the user's 'notation' cache directory.
- Either disable the Online Certificate Status Protocol (OCSP) revocation check, or utilize certificates that exclusively support Certificate Revocation Lists (CRLs) for revocation check.
- Try to verify a previously generated signature using the 'notation' tool.
Impact
The signature verification process is aborted as process crashes.
Remediation
The cache file should be created, written, then copied to the wanted final location, and finally removed. Additionally, this error shouldn't lead to a crash as it is not fatal and shouldn't prevent the rest of the program to properly continue
Severity
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/notaryproject/notation-go"
},
"ranges": [
{
"events": [
{
"introduced": "1.3.0-rc.1"
},
{
"fixed": "1.3.0-rc.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.3.0-rc.1"
]
}
],
"aliases": [
"CVE-2024-51491"
],
"database_specific": {
"cwe_ids": [
"CWE-703"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-13T16:13:59Z",
"nvd_published_at": "2025-01-13T22:15:13Z",
"severity": "LOW"
},
"details": "### Summary\nThe issue was identified during Quarkslab\u0027s security audit on the Certificate Revocation List (CRL) based revocation check feature.\nAfter retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination.\n\n### Details\n\nIn method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on `rename` syscall from the libc and as per the [documentation](https://man7.org/linux/man-pages/man2/rename.2.html), moving a file to a different mountpoint raises an `EXDEV` error, interpreted as `Cross device link not permitted error`.\nSome Linux distribution, like `RedHat` use a dedicated filesystem (`tmpfs`), mounted on a specific mountpoint (usually `/tmp`) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash `notation`. \n\n### PoC\n1. Ensure that the temporary file storage area (e.g., /tmp) is mounted on a different mount point than the user\u0027s \u0027notation\u0027 cache directory.\n2. Either disable the Online Certificate Status Protocol (OCSP) revocation check, or utilize certificates that exclusively support Certificate Revocation Lists (CRLs) for revocation check.\n3. Try to verify a previously generated signature using the \u0027notation\u0027 tool.\n\n### Impact\nThe signature verification process is aborted as process crashes.\n\n### Remediation\nThe cache file should be created, written, then copied to the wanted final location, and finally removed. Additionally, this error shouldn\u0027t lead to a crash as it is not fatal and shouldn\u0027t prevent the rest of the program to properly continue\n",
"id": "GHSA-qjh3-4j3h-vmwp",
"modified": "2025-01-14T21:07:52Z",
"published": "2025-01-13T16:13:59Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/notaryproject/notation-go/security/advisories/GHSA-qjh3-4j3h-vmwp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-51491"
},
{
"type": "WEB",
"url": "https://github.com/notaryproject/notation-go/commit/3c3302258ad510fbca2f8a73731569d91f07d196"
},
{
"type": "PACKAGE",
"url": "https://github.com/notaryproject/notation-go"
},
{
"type": "WEB",
"url": "https://man7.org/linux/man-pages/man2/rename.2.html"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3382"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
],
"summary": "notation-go has an OS error when setting CRL cache leads to denial of signature verification"
}
GHSA-QM62-5PC4-C833
Vulnerability from github – Published: 2022-10-14 19:00 – Updated: 2025-05-14 18:30
VLAI
Details
The DFX unwind stack module of the ArkCompiler has a vulnerability in interface calling.Successful exploitation of this vulnerability affects system services and device availability.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-41589"
],
"database_specific": {
"cwe_ids": [
"CWE-703"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-14T16:15:00Z",
"severity": "HIGH"
},
"details": "The DFX unwind stack module of the ArkCompiler has a vulnerability in interface calling.Successful exploitation of this vulnerability affects system services and device availability.",
"id": "GHSA-qm62-5pc4-c833",
"modified": "2025-05-14T18:30:34Z",
"published": "2022-10-14T19:00:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41589"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2022/10"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-QM7R-2H56-XQM9
Vulnerability from github – Published: 2026-08-18 00:30 – Updated: 2026-08-18 18:31
VLAI
Details
This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2026-65332"
],
"database_specific": {
"cwe_ids": [
"CWE-703"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-17T22:17:24Z",
"severity": "MODERATE"
},
"details": "This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.",
"id": "GHSA-qm7r-2h56-xqm9",
"modified": "2026-08-18T18:31:52Z",
"published": "2026-08-18T00:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65332"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148281"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148282"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148286"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/148287"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-QVJG-564F-22C8
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2025-10-22 00:32
VLAI
Details
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.
Severity
6.7 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-25372"
],
"database_specific": {
"cwe_ids": [
"CWE-703",
"CWE-787"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-26T19:15:00Z",
"severity": "HIGH"
},
"details": "An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access.",
"id": "GHSA-qvjg-564f-22c8",
"modified": "2025-10-22T00:32:05Z",
"published": "2022-05-24T17:45:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25372"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-25372"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R344-XW3P-2FRJ
Vulnerability from github – Published: 2023-10-19 16:08 – Updated: 2023-10-19 16:08
VLAI
Summary
Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions
Details
Impact
The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the @defer or Subscriptions, the Router will panic.
To be vulnerable, users of Router must have a coprocessor with coprocessor.supergraph.response configured in their router.yaml and also to support either @defer or Subscriptions.
Patches
Router version 1.33.0 has a fix for this vulnerability. https://github.com/apollographql/router/pull/4014 fixes the issue.
Workarounds
For affected versions, avoid using the coprocessor supergraph response:
# do not use this stage in your coprocessor configuration
coprocessor:
supergraph:
response:
Or you can disable defer and subscriptions support:
# disable defer and subscriptions:
supergraph:
defer_support: false # enabled by default
subscription:
enabled: false # disabled by default
and continue to use the coprocessor supergraph response.
References
https://github.com/apollographql/router/issues/4013
Severity
7.5 (High)
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "apollo-router"
},
"ranges": [
{
"events": [
{
"introduced": "1.31.0"
},
{
"fixed": "1.33.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-45812"
],
"database_specific": {
"cwe_ids": [
"CWE-703",
"CWE-754"
],
"github_reviewed": true,
"github_reviewed_at": "2023-10-19T16:08:10Z",
"nvd_published_at": "2023-10-18T22:15:09Z",
"severity": "HIGH"
},
"details": "### Impact\nThe Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and terminate when a multi-part response is sent. When users send queries to the router that uses the `@defer` or Subscriptions, the Router will panic.\n \nTo be vulnerable, users of Router must have a coprocessor with `coprocessor.supergraph.response` configured in their `router.yaml` and also to support either `@defer` or Subscriptions. \n\n### Patches\nRouter version 1.33.0 has a fix for this vulnerability. https://github.com/apollographql/router/pull/4014 fixes the issue. \n\n### Workarounds\nFor affected versions, avoid using the coprocessor supergraph response:\n```yml\n# do not use this stage in your coprocessor configuration\ncoprocessor:\n supergraph:\n response:\n``` \n\nOr you can disable defer and subscriptions support:\n```yml\n# disable defer and subscriptions:\nsupergraph:\n defer_support: false # enabled by default\nsubscription:\n enabled: false # disabled by default\n```\nand continue to use the coprocessor supergraph response.\n### References\nhttps://github.com/apollographql/router/issues/4013\n",
"id": "GHSA-r344-xw3p-2frj",
"modified": "2023-10-19T16:08:10Z",
"published": "2023-10-19T16:08:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/apollographql/router/security/advisories/GHSA-r344-xw3p-2frj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45812"
},
{
"type": "WEB",
"url": "https://github.com/apollographql/router/issues/4013"
},
{
"type": "WEB",
"url": "https://github.com/apollographql/router/pull/4014"
},
{
"type": "WEB",
"url": "https://github.com/apollographql/router/commit/b917b8c117b46a2d508428c0856f4927dfcfc341"
},
{
"type": "PACKAGE",
"url": "https://github.com/apollographql/router"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apollo Router vulnerable to Improper Check or Handling of Exceptional Conditions"
}
GHSA-R76G-G87F-VW8F
Vulnerability from github – Published: 2024-04-24 20:03 – Updated: 2024-06-10 19:33
VLAI
Summary
Kubelet Incorrect Privilege Assignment
Details
In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0.
Severity
4.9 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes/cmd/kubelet"
},
"ranges": [
{
"events": [
{
"introduced": "1.14.0"
},
{
"fixed": "1.14.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/kubernetes/cmd/kubelet"
},
"ranges": [
{
"events": [
{
"introduced": "1.13.0"
},
{
"fixed": "1.13.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2019-11245"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-703"
],
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:03:48Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit `runAsUser` attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified `mustRunAsNonRoot: true`, the kubelet will refuse to start the container as root. If the pod did not specify `mustRunAsNonRoot: true`, the kubelet will run the container as uid 0.",
"id": "GHSA-r76g-g87f-vw8f",
"modified": "2024-06-10T19:33:51Z",
"published": "2024-04-24T20:03:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11245"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/78308"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/76665"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/pull/76665/commits/26e3c8674e66f0d10170d34f5445f0aed207387f"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1715726"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-r76g-g87f-vw8f"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/kubernetes"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2024-2780"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190919-0003"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
],
"summary": "Kubelet Incorrect Privilege Assignment"
}
GHSA-R786-G2J8-4P9W
Vulnerability from github – Published: 2024-08-02 06:30 – Updated: 2024-08-02 06:30
VLAI
Details
CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A highly privileged malicious user with remote access could potentially exploit this vulnerability, leading to execute unauthorized actions and retrieve sensitive information from the database.
Severity
6.6 (Medium)
{
"affected": [],
"aliases": [
"CVE-2024-38482"
],
"database_specific": {
"cwe_ids": [
"CWE-703"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-02T04:17:27Z",
"severity": "MODERATE"
},
"details": "CloudLink, versions 7.1.x and 8.x, contain an Improper check or handling of Exceptional Conditions Vulnerability in Cluster Component. A highly privileged malicious user with remote access could potentially exploit this vulnerability, leading to execute unauthorized actions and retrieve sensitive information from the database.",
"id": "GHSA-r786-g2j8-4p9w",
"modified": "2024-08-02T06:30:56Z",
"published": "2024-08-02T06:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-38482"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-us/000227493/dsa-2024-343-security-update-for-dell-cloudlink-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-RCMH-QJQH-P98V
Vulnerability from github – Published: 2025-12-01 20:44 – Updated: 2026-07-15 21:55
VLAI
Summary
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
Details
Summary
A DoS can occur that immediately halts the system due to the use of an unsafe function.
Details
According to RFC 5322, nested group structures (a group inside another group) are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested groups appear, since such input is likely to be abnormal. (If the address is valid, it is added as-is.) In other words, the parser flattens all nested groups and inserts them into the final group list. However, the code implemented for this flattening process can be exploited by malicious input and triggers DoS
RFC 5322 uses a colon (:) to define a group, and commas (,) are used to separate members within a group. At the following location in lib/addressparser/index.js:
https://github.com/nodemailer/nodemailer/blob/master/lib/addressparser/index.js#L90
there is code that performs this flattening. The issue occurs when the email address parser attempts to process the following kind of malicious address header:
g0: g1: g2: g3: ... gN: victim@example.com;
Because no recursion depth limit is enforced, the parser repeatedly invokes itself in the pattern
addressparser → _handleAddress → addressparser → ...
for each nested group. As a result, when an attacker sends a header containing many colons, Nodemailer enters infinite recursion, eventually throwing Maximum call stack size exceeded and causing the process to terminate immediately. Due to the structure of this behavior, no authentication is required, and a single request is enough to shut down the service.
The problematic code section is as follows:
if (isGroup) {
...
if (data.group.length) {
let parsedGroup = addressparser(data.group.join(',')); // <- boom!
parsedGroup.forEach(member => {
if (member.group) {
groupMembers = groupMembers.concat(member.group);
} else {
groupMembers.push(member);
}
});
}
}
data.group is expected to contain members separated by commas, but in the attacker’s payload the group contains colon (:) tokens. Because of this, the parser repeatedly triggers recursive calls for each colon, proportional to their number.
PoC
const nodemailer = require('nodemailer');
function buildDeepGroup(depth) {
let parts = [];
for (let i = 0; i < depth; i++) {
parts.push(`g${i}:`);
}
return parts.join(' ') + ' user@example.com;';
}
const DEPTH = 3000; // <- control depth
const toHeader = buildDeepGroup(DEPTH);
console.log('to header length:', toHeader.length);
const transporter = nodemailer.createTransport({
streamTransport: true,
buffer: true,
newline: 'unix'
});
console.log('parsing start');
transporter.sendMail(
{
from: 'test@example.com',
to: toHeader,
subject: 'test',
text: 'test'
},
(err, info) => {
if (err) {
console.error('error:', err);
} else {
console.log('finished :', info && info.envelope);
}
}
);
As a result, when the colon is repeated beyond a certain threshold, the Node.js process terminates immediately.
Impact
The attacker can achieve the following:
- Force an immediate crash of any server/service that uses Nodemailer
- Kill the backend process with a single web request
- In environments using PM2/Forever, trigger a continuous restart loop, causing severe resource exhaustion”
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 7.0.10"
},
"package": {
"ecosystem": "npm",
"name": "nodemailer"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "7.0.11"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.webjars.npm:nodemailer"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"last_affected": "6.10.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-14874"
],
"database_specific": {
"cwe_ids": [
"CWE-703"
],
"github_reviewed": true,
"github_reviewed_at": "2025-12-01T20:44:25Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "### Summary\nA DoS can occur that immediately halts the system due to the use of an unsafe function.\n\n### Details\nAccording to **RFC 5322**, nested group structures (a group inside another group) are not allowed. Therefore, in lib/addressparser/index.js, the email address parser performs flattening when nested groups appear, since such input is likely to be abnormal. (If the address is valid, it is added as-is.) In other words, the parser flattens all nested groups and inserts them into the final group list.\nHowever, the code implemented for this flattening process can be exploited by malicious input and triggers DoS\n\nRFC 5322 uses a colon (:) to define a group, and commas (,) are used to separate members within a group.\nAt the following location in lib/addressparser/index.js:\n\nhttps://github.com/nodemailer/nodemailer/blob/master/lib/addressparser/index.js#L90\n\nthere is code that performs this flattening. The issue occurs when the email address parser attempts to process the following kind of malicious address header:\n\n```g0: g1: g2: g3: ... gN: victim@example.com;```\n\nBecause no recursion depth limit is enforced, the parser repeatedly invokes itself in the pattern\n`addressparser \u2192 _handleAddress \u2192 addressparser \u2192 ...`\nfor each nested group. As a result, when an attacker sends a header containing many colons, Nodemailer enters infinite recursion, eventually throwing Maximum call stack size exceeded and causing the process to terminate immediately. Due to the structure of this behavior, no authentication is required, and a single request is enough to shut down the service.\n\nThe problematic code section is as follows:\n```js\nif (isGroup) {\n ...\n if (data.group.length) {\n let parsedGroup = addressparser(data.group.join(\u0027,\u0027)); // \u003c- boom!\n parsedGroup.forEach(member =\u003e {\n if (member.group) {\n groupMembers = groupMembers.concat(member.group);\n } else {\n groupMembers.push(member);\n }\n });\n }\n}\n```\n`data.group` is expected to contain members separated by commas, but in the attacker\u2019s payload the group contains colon `(:)` tokens. Because of this, the parser repeatedly triggers recursive calls for each colon, proportional to their number.\n\n### PoC\n\n```\nconst nodemailer = require(\u0027nodemailer\u0027);\n\nfunction buildDeepGroup(depth) {\n let parts = [];\n for (let i = 0; i \u003c depth; i++) {\n parts.push(`g${i}:`);\n }\n return parts.join(\u0027 \u0027) + \u0027 user@example.com;\u0027;\n}\n\nconst DEPTH = 3000; // \u003c- control depth \nconst toHeader = buildDeepGroup(DEPTH);\nconsole.log(\u0027to header length:\u0027, toHeader.length);\n\nconst transporter = nodemailer.createTransport({\n streamTransport: true,\n buffer: true,\n newline: \u0027unix\u0027\n});\n\nconsole.log(\u0027parsing start\u0027);\n\ntransporter.sendMail(\n {\n from: \u0027test@example.com\u0027,\n to: toHeader,\n subject: \u0027test\u0027,\n text: \u0027test\u0027\n },\n (err, info) =\u003e {\n if (err) {\n console.error(\u0027error:\u0027, err);\n } else {\n console.log(\u0027finished :\u0027, info \u0026\u0026 info.envelope);\n }\n }\n);\n```\nAs a result, when the colon is repeated beyond a certain threshold, the Node.js process terminates immediately.\n\n### Impact\nThe attacker can achieve the following:\n\n1. Force an immediate crash of any server/service that uses Nodemailer\n2. Kill the backend process with a single web request\n3. In environments using PM2/Forever, trigger a continuous restart loop, causing severe resource exhaustion\u201d",
"id": "GHSA-rcmh-qjqh-p98v",
"modified": "2026-07-15T21:55:30Z",
"published": "2025-12-01T20:44:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/nodemailer/nodemailer/security/advisories/GHSA-rcmh-qjqh-p98v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14874"
},
{
"type": "WEB",
"url": "https://github.com/nodemailer/nodemailer/commit/6218b8df"
},
{
"type": "WEB",
"url": "https://github.com/nodemailer/nodemailer/commit/b61b9c0cfd682b6f647754ca338373b68336a150"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-14874"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418133"
},
{
"type": "PACKAGE",
"url": "https://github.com/nodemailer/nodemailer"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Nodemailer\u2019s addressparser is vulnerable to DoS caused by recursive calls"
}
GHSA-RH4C-32WR-89CJ
Vulnerability from github – Published: 2023-08-31 00:30 – Updated: 2024-04-04 07:18
VLAI
Details
An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-39136"
],
"database_specific": {
"cwe_ids": [
"CWE-703"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-08-30T22:15:08Z",
"severity": "MODERATE"
},
"details": "An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafted zip file.",
"id": "GHSA-rh4c-32wr-89cj",
"modified": "2024-04-04T07:18:15Z",
"published": "2023-08-31T00:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39136"
},
{
"type": "WEB",
"url": "https://github.com/ZipArchive/ZipArchive/issues/680"
},
{
"type": "WEB",
"url": "https://blog.ostorlab.co/zip-packages-exploitation.html"
},
{
"type": "WEB",
"url": "https://ostorlab.co/vulndb/advisory/OVE-2023-2"
},
{
"type": "WEB",
"url": "https://security.snyk.io/research/zip-slip-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
No mitigation information available for this CWE.
No CAPEC attack patterns related to this CWE.